<html>
<head><meta charset="utf-8"><title>Undefined behavior is a security bug? · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Undefined.20behavior.20is.20a.20security.20bug.3F.html">Undefined behavior is a security bug?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="220434807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Undefined%20behavior%20is%20a%20security%20bug%3F/near/220434807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Brian Anderson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Undefined.20behavior.20is.20a.20security.20bug.3F.html#220434807">(Dec 18 2020 at 22:19)</a>:</h4>
<p>Do experts generally consider undefined behavior a security bug? I do because it opens the possibility for any misbehavior in the future, but I wonder if that is a consensus view.</p>



<a name="220435066"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Undefined%20behavior%20is%20a%20security%20bug%3F/near/220435066" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Undefined.20behavior.20is.20a.20security.20bug.3F.html#220435066">(Dec 18 2020 at 22:21)</a>:</h4>
<p>Personally I think it depends on the issue. In general I think something like that is the consensus though.</p>



<a name="220446666"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Undefined%20behavior%20is%20a%20security%20bug%3F/near/220446666" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Undefined.20behavior.20is.20a.20security.20bug.3F.html#220446666">(Dec 19 2020 at 01:34)</a>:</h4>
<p>Depends on the exact case. The RustSec policy is "if in doubt, surface it as a warning".</p>



<a name="220474690"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Undefined%20behavior%20is%20a%20security%20bug%3F/near/220474690" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Undefined.20behavior.20is.20a.20security.20bug.3F.html#220474690">(Dec 19 2020 at 15:37)</a>:</h4>
<p>yeah, we made a whole separate <code>unsound</code> categorization of informational (as opposed to security/vulnerability) advisories for this purpose</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>